Fix: replace all settings.algorithm references with hardcoded ALGORITHM

SEC-11 removed algorithm from Settings but missed 3 call sites:
- auth.py line 68: jwt.decode in get_current_user
- integrations.py lines 58, 120: jwt.decode in OAuth callbacks

All now use ALGORITHM constant or inline 'HS256'.

backend/app/routers/integrations.py

@@ -55,7 +55,7 @@ async def strava_callback(
     from app.config import get_settings
     _settings = get_settings()
     try:
-        payload = jose_jwt.decode(state, _settings.secret_key, algorithms=[_settings.algorithm])
+        payload = jose_jwt.decode(state, _settings.secret_key, algorithms=["HS256"])
         user_id = uuid_mod.UUID(payload["sub"])
     except (JWTError, KeyError, ValueError):
         raise HTTPException(status_code=400, detail="Invalid or expired OAuth state")
@@ -117,7 +117,7 @@ async def polar_callback(
     from app.config import get_settings
     _settings = get_settings()
     try:
-        payload = jose_jwt.decode(state, _settings.secret_key, algorithms=[_settings.algorithm])
+        payload = jose_jwt.decode(state, _settings.secret_key, algorithms=["HS256"])
         user_id = uuid_mod.UUID(payload["sub"])
     except (JWTError, KeyError, ValueError):
         raise HTTPException(status_code=400, detail="Invalid or expired OAuth state")

backend/app/utils/auth.py

@@ -65,7 +65,7 @@ async def get_current_user(
 
     # Standard JWT validation
     try:
-        payload = jwt.decode(token, settings.secret_key, algorithms=[settings.algorithm])
+        payload = jwt.decode(token, settings.secret_key, algorithms=[ALGORITHM])
         user_id: str = payload.get("sub")
         if user_id is None:
             raise credentials_exception